# Latest **URL:** https://discuss.elastic.co/latest.md?page=1212 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1213 --- ## [Remove field after parsing json](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973)
**Author:** [@raspi](https://discuss.elastic.co/u/raspi)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 5:27pm UTC](https://discuss.elastic.co/t/remove-field-after-parsing-json/299973 "2022-03-17T17:27:35Z")
Hello i need help please this is my logstash.conf \< filter { if "jaeger" in \[message\] { drop { } } mutate { gsub =\> \["message", '"message":', '"containerlogs":'\] remove\_tag =\> \[ "pfd", "middle", "fluentd", "bea… --- ## [Issue transforming data for Vega visualization](https://discuss.elastic.co/t/issue-transforming-data-for-vega-visualization/299669)
**Author:** [@shaigbdb](https://discuss.elastic.co/u/shaigbdb)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 5:22pm UTC](https://discuss.elastic.co/t/issue-transforming-data-for-vega-visualization/299669 "2022-03-17T17:22:46Z")
I have the following response: aggregations" : { "a" : {...}, "b" : {...}, "c" : {...}, "d" : { "value" : 5 }, "e" : { "value" : 6 }, "f" : { "value" : 7 } } d, e and f are sum\_bucket aggr… --- ## [Index data getting deleted automatically after some time,parsing oracle data from logstash to elastic](https://discuss.elastic.co/t/index-data-getting-deleted-automatically-after-some-time-parsing-oracle-data-from-logstash-to-elastic/299979)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 5:13pm UTC](https://discuss.elastic.co/t/index-data-getting-deleted-automatically-after-some-time-parsing-oracle-data-from-logstash-to-elastic/299979 "2022-03-17T17:13:50Z")
Hello All, I'm trying to get data from oracle db and parsing it through logstash pipeline and finally to elastic. while checking the data in discover in kibana ,observed that the data gets automaticaly deleted after fe… --- ## [Running a Match across Array and treating each row exclusively](https://discuss.elastic.co/t/running-a-match-across-array-and-treating-each-row-exclusively/299096)
**Author:** [@snoopy20](https://discuss.elastic.co/u/snoopy20)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 4:59pm UTC](https://discuss.elastic.co/t/running-a-match-across-array-and-treating-each-row-exclusively/299096 "2022-03-17T16:59:07Z")
Hi, I had several keys on an object (such as .name1, .name2) and was using dis\_max along with match to run independent and identical queries and return the one with the highest score. Now the data has changed to an Arra… --- ## [I do not receive the logs in Logstash (Heroku)](https://discuss.elastic.co/t/i-do-not-receive-the-logs-in-logstash-heroku/299895)
**Author:** [@Diego\_T](https://discuss.elastic.co/u/Diego_T)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 4:21pm UTC](https://discuss.elastic.co/t/i-do-not-receive-the-logs-in-logstash-heroku/299895 "2022-03-17T16:21:27Z")
i have open the port 1514 (tcp) in my windows (localhost) i wanna see the logs of Heroku in the Elasticsearch remote (gcp) but I do not receive any log file .conf input { tcp { port =\> "1514" tags =\> \["h… --- ## [Filebeat : How to get multiline logs together (with pattern) in one block](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971)
**Author:** [@MLAYEH\_Ismail](https://discuss.elastic.co/u/MLAYEH_Ismail)\ **Replies:** 4\ **Last updated:** [March 17, 2022, 4:14pm UTC](https://discuss.elastic.co/t/filebeat-how-to-get-multiline-logs-together-with-pattern-in-one-block/299971 "2022-03-17T16:14:46Z")
Hi everyone, im working on extracting log by filebeat and processing it by ELK stack. every thing works exept that the logs are readed line per line and not by block with the specified pattern . thank you in advance. t… --- ## [Can't connect filebeat to elastic search](https://discuss.elastic.co/t/cant-connect-filebeat-to-elastic-search/299966)
**Author:** [@Mariem](https://discuss.elastic.co/u/Mariem)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 3:51pm UTC](https://discuss.elastic.co/t/cant-connect-filebeat-to-elastic-search/299966 "2022-03-17T15:51:46Z")
this is my filebeat configuration file : when i execute filebeat setup -e : Can someone help me??? --- ## [Network 3D maps](https://discuss.elastic.co/t/network-3d-maps/299965)
**Author:** [@labate](https://discuss.elastic.co/u/labate)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 3:24pm UTC](https://discuss.elastic.co/t/network-3d-maps/299965 "2022-03-17T15:24:31Z")
Hello to all, I would like to know if it is possible or not to create a map of my network and interact with my data (and not with the world map already present). For example I will create my network map automatically o… --- ## [New tenant created with saved objects](https://discuss.elastic.co/t/new-tenant-created-with-saved-objects/299963)
**Author:** [@NadyLeez123](https://discuss.elastic.co/u/NadyLeez123)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 3:24pm UTC](https://discuss.elastic.co/t/new-tenant-created-with-saved-objects/299963 "2022-03-17T15:24:18Z")
Hi everyone I'm experiencing something weird with elastic 7.6 I have a tenant in which I created a dasboard. That dashboard named "iis-board" bears many visualizations and an index pattern named log-iis\*. It is not the… --- ## [Understand async and wait\_for mode](https://discuss.elastic.co/t/understand-async-and-wait-for-mode/299939)
**Author:** [@Remy\_Letient](https://discuss.elastic.co/u/Remy_Letient)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 3:14pm UTC](https://discuss.elastic.co/t/understand-async-and-wait-for-mode/299939 "2022-03-17T15:14:33Z")
Hi, A question about the async mode (when I don't specify the option 'refresh=wait\_for') and when I specify. Qeustion: in the same index I have 2 documents: 'A' and 'B'. If I update the document 'A' with no refresh op… --- ## [Adding a field to \[ctx.payload\]](https://discuss.elastic.co/t/adding-a-field-to-ctx-payload/299943)
**Author:** [@stobbe99](https://discuss.elastic.co/u/stobbe99)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 11:41am UTC](https://discuss.elastic.co/t/adding-a-field-to-ctx-payload/299943 "2022-03-17T11:41:42Z")
Hello, I have create a watcher that grab's data from a REST interface removes Headers and Status\_code. My question : can I add a additional field to the payload? As I understand the payload is one complete field so bas… --- ## [Cannot disable security in 8.1](https://discuss.elastic.co/t/cannot-disable-security-in-8-1/299857)
**Author:** [@fulkon](https://discuss.elastic.co/u/fulkon)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 2:37pm UTC](https://discuss.elastic.co/t/cannot-disable-security-in-8-1/299857 "2022-03-17T14:37:47Z")
I need elasticsearch without any security. In 7.17 it was enough to set xpack.security.enabled: false, but in 8.1.0 got error on startup: org.elasticsearch.ElasticsearchSecurityException: invalid configuration for xpack… --- ## [A few questions around the can\_match feature](https://discuss.elastic.co/t/a-few-questions-around-the-can-match-feature/297713)
**Author:** [@Bryan\_Hamilton](https://discuss.elastic.co/u/Bryan_Hamilton)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 2:13pm UTC](https://discuss.elastic.co/t/a-few-questions-around-the-can-match-feature/297713 "2022-03-17T14:13:32Z")
Hi, @jpountz and @ruflin. I working on a migration path to migrate our on-prem environment from xxxbeat-\* type indices to datastreams based on the elastic Agent. This will require updating/recreating all sorts of objects… --- ## [How to enable security on an existing 8.1 multi nodes docker cluster](https://discuss.elastic.co/t/how-to-enable-security-on-an-existing-8-1-multi-nodes-docker-cluster/299268)
**Author:** [@jean.bissonnette](https://discuss.elastic.co/u/jean.bissonnette)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 2:07pm UTC](https://discuss.elastic.co/t/how-to-enable-security-on-an-existing-8-1-multi-nodes-docker-cluster/299268 "2022-03-17T14:07:33Z")
I have an existing 5 nodes podman cluster. 4 nodes are on one VM, another node is on another VM. Security is not enabled (xpack.security.enabled: false). I tried to setup security by calling: bin/Elasticsearch-setup-p… --- ## [Unable to export Kibana dashboard](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard/298080)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 23\ **Last updated:** [March 17, 2022, 2:06pm UTC](https://discuss.elastic.co/t/unable-to-export-kibana-dashboard/298080 "2022-03-17T14:06:08Z")
Hi All. I am using ELK7.6.2 stack. When I try to export a dashboard I get a 404 error. Please see below $ curl -k -u user:password -X GET "http://\`hostname\`:5601/api/kibana/dashboards/export?dashboard=93454870-94dc-11e… --- ## [Saving percolator with query string and wildcard fields search](https://discuss.elastic.co/t/saving-percolator-with-query-string-and-wildcard-fields-search/293991)
**Author:** [@vohanka](https://discuss.elastic.co/u/vohanka)\ **Replies:** 8\ **Last updated:** [March 17, 2022, 1:33pm UTC](https://discuss.elastic.co/t/saving-percolator-with-query-string-and-wildcard-fields-search/293991 "2022-03-17T13:33:20Z")
Hello I am trying to save percolator query with code which looks like this "query": "Content.\\\\\*:apple OR android" but i got error response which looks like this No field mapping can be found for the field with name … --- ## [Failed to query elasticsearch for previous event Cannot cast org.jruby.RubyNil to org.jruby.RubyString](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event-cannot-cast-org-jruby-rubynil-to-org-jruby-rubystring/299953)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 1:06pm UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event-cannot-cast-org-jruby-rubynil-to-org-jruby-rubystring/299953 "2022-03-17T13:06:18Z")
Im using Elasticsearch filter plugin as below elasticsearch { hosts =\> \["localhost:9200"\] index =\> "dashboard\_write" query =\> "sessionID:%{\[sid\]}" fields =\> \["authsid","sid"\] … --- ## [Excessive time to recreate the index](https://discuss.elastic.co/t/excessive-time-to-recreate-the-index/299699)
**Author:** [@hrodriguez](https://discuss.elastic.co/u/hrodriguez)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 12:00pm UTC](https://discuss.elastic.co/t/excessive-time-to-recreate-the-index/299699 "2022-03-17T12:00:49Z")
Hi! I am working with Kibana and I have some problems with my index. I use two index one is allways correct and never lost data. These index are made by a consult to PosgreSQL this only take 100ms but on kibana the da… --- ## [Elasticsearch-java - BulkOperation and IndexRequest have different behaviour with same custom JsonpSerializer](https://discuss.elastic.co/t/elasticsearch-java-bulkoperation-and-indexrequest-have-different-behaviour-with-same-custom-jsonpserializer/298496)
**Author:** [@fmarazita](https://discuss.elastic.co/u/fmarazita)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-java-bulkoperation-and-indexrequest-have-different-behaviour-with-same-custom-jsonpserializer/298496 "2022-03-17T11:10:20Z")
Hi, It seems that BulkOperation and IndexRequest with same tDocumentSerialization have different behaviour. Elastic version: 7.16.3 I created a test with the same upsert operation, with and without using bulk operatio… --- ## [Unable to configure OIDC using the trail licence with azure AD](https://discuss.elastic.co/t/unable-to-configure-oidc-using-the-trail-licence-with-azure-ad/297746)
**Author:** [@susmithabadam1609](https://discuss.elastic.co/u/susmithabadam1609)\ **Replies:** 7\ **Last updated:** [March 17, 2022, 10:38am UTC](https://discuss.elastic.co/t/unable-to-configure-oidc-using-the-trail-licence-with-azure-ad/297746 "2022-03-17T10:38:06Z")
Hi Team I have installed ECK operator with trail licence to test OIDC with azure AD in EKS cluster. I have configured OIDC by following the below document: but I'm facing the below issue Status of trail licence: … --- ## [Unassigned shards because of different elasticsearch version](https://discuss.elastic.co/t/unassigned-shards-because-of-different-elasticsearch-version/299182)
**Author:** [@aman123](https://discuss.elastic.co/u/aman123)\ **Replies:** 5\ **Last updated:** [March 17, 2022, 10:33am UTC](https://discuss.elastic.co/t/unassigned-shards-because-of-different-elasticsearch-version/299182 "2022-03-17T10:33:06Z")
Hi All, Recently I have upgraded the one data node , Node got successfully upgraded but there are some unassigned shards which are not being replicated to other nodes because of below error: "explanation" : "cannot all… --- ## [ELK installing](https://discuss.elastic.co/t/elk-installing/299936)
**Author:** [@SOC](https://discuss.elastic.co/u/SOC)\ **Replies:** 0\ **Last updated:** [March 17, 2022, 10:31am UTC](https://discuss.elastic.co/t/elk-installing/299936 "2022-03-17T10:31:41Z")
HI All I'm planning for deploy ELK SIEM 8.1 for small organization, as of now I don't have any idea of how many assets or servers i need integrate in ELK SIEM. Please let me know system requirement or server configurat… --- ## [Update by Query elastic on field type as Text - ES 7.17](https://discuss.elastic.co/t/update-by-query-elastic-on-field-type-as-text-es-7-17/299837)
**Author:** [@vitaly1233](https://discuss.elastic.co/u/vitaly1233)\ **Replies:** 3\ **Last updated:** [March 17, 2022, 10:23am UTC](https://discuss.elastic.co/t/update-by-query-elastic-on-field-type-as-text-es-7-17/299837 "2022-03-17T10:23:36Z")
Trying to do "findAndModify" in ES According to doc Update By Query API | Elasticsearch Guide \[7.17\] | Elastic We have mapping as the following: { "dynamic\_templates": \[ { "strings\_as\_keywords": { … --- ## [When using synonyms, got exception "term: xxx analyzed to a token (xxx) with position increment != 1 (got: 0)](https://discuss.elastic.co/t/when-using-synonyms-got-exception-term-xxx-analyzed-to-a-token-xxx-with-position-increment-1-got-0/299259)
**Author:** [@Cindy\_X](https://discuss.elastic.co/u/Cindy_X)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:06am UTC](https://discuss.elastic.co/t/when-using-synonyms-got-exception-term-xxx-analyzed-to-a-token-xxx-with-position-increment-1-got-0/299259 "2022-03-17T10:06:18Z")
Hi team, We tried to find the root cause of an exception while using synonyms. This is the synonym filter: "japanese\_index\_synonym": { "type": "synonym\_graph", "lenient": false, "sy… --- ## [Elastic did not load properly. Check the server output for more information](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/299366)
**Author:** [@Lucas\_Roberto](https://discuss.elastic.co/u/Lucas_Roberto)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:03am UTC](https://discuss.elastic.co/t/elastic-did-not-load-properly-check-the-server-output-for-more-information/299366 "2022-03-17T10:03:42Z")
I followed the ES Quickstart guide, but I still receiving the error "Elastic did not load properly. Check the server output for more information" when I try to acess the KIbana dashboard on my browser. For information, … --- ## [Upgrade to 8.1 from 7.14.0](https://discuss.elastic.co/t/upgrade-to-8-1-from-7-14-0/299409)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:03am UTC](https://discuss.elastic.co/t/upgrade-to-8-1-from-7-14-0/299409 "2022-03-17T10:03:21Z")
We are planning to upgrade Elasticsearch from 7.14 to 8.1. The doubt I have is about index templates. As legacy templates are deprecated in favor of composable templates. So before upgrade do we need to change all exist… --- ## [Union of queries in highRestClient java 7.9.1](https://discuss.elastic.co/t/union-of-queries-in-highrestclient-java-7-9-1/299568)
**Author:** [@Anna\_Kuranda](https://discuss.elastic.co/u/Anna_Kuranda)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:02am UTC](https://discuss.elastic.co/t/union-of-queries-in-highrestclient-java-7-9-1/299568 "2022-03-17T10:02:18Z")
I try to do few selects in elk and union results of query Like in sql (select .... ) UNION (select..) Is there way todo it in one request ? Thanks --- ## [Outsource parts in queries](https://discuss.elastic.co/t/outsource-parts-in-queries/299450)
**Author:** [@simobrusch](https://discuss.elastic.co/u/simobrusch)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 10:01am UTC](https://discuss.elastic.co/t/outsource-parts-in-queries/299450 "2022-03-17T10:01:03Z")
So let's say I have the following code in C# using NEST: private ISearchResponse\ GetFilteredResultsByIds(ElasticClient client, Query query) { return client.Search\(s =\> s … --- ## [Store certificated in keystore](https://discuss.elastic.co/t/store-certificated-in-keystore/299889)
**Author:** [@ginolegigot](https://discuss.elastic.co/u/ginolegigot)\ **Replies:** 2\ **Last updated:** [March 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889 "2022-03-17T09:51:26Z")
Hello, If i properly understood this doc and especially this paragraph: The elasticsearch-certutil outputs a PKCS#12 keystore which includes the CA certificate as a trusted certificate entry. This allows for the keyst… --- ## [Include all hosts that met condition in watcher email alert](https://discuss.elastic.co/t/include-all-hosts-that-met-condition-in-watcher-email-alert/299866)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 1\ **Last updated:** [March 17, 2022, 9:34am UTC](https://discuss.elastic.co/t/include-all-hosts-that-met-condition-in-watcher-email-alert/299866 "2022-03-17T09:34:58Z")
Hello, I am wondering if it is possible to include all hosts that have met the condition set in the watcher in one email? I would like to send my clients a list of devices that have met the condition once a day. Here i… [Previous page](https://discuss.elastic.co/latest.md?page=1211) [Next page](https://discuss.elastic.co/latest.md?page=1213)